adam/orchestrator
Archived
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

chore(security-review): bring confluence-doc online in the nightly coordinator (#42)

Browse source 
confluence-doc is provisioned (OAuth 2.0 service-account creds in ~/secrev.env +
PAGE_MAP_FILE from the live IT space). Drop it from COORDINATOR_SKIP_ROLES (now
just aws-posture) and add Environment=PAGE_MAP_FILE. Verified live on the box:
'Confluence API: oauth auth ready', 21 recommend-only doc gaps reported (D7, no
writes). aws-posture stays skipped (IAM/step-ca not stood up).
This commit is contained in:
Adam Moussa 2026-06-22 19:54:53 -04:00 • committed by GitHub
parent 593f8c60b8
commit 71036cb3f4
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
1 changed files with 9 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
security-review/systemd/sea-haven-checkers.service
View file

@ -18,8 +18,11 @@
#
# COORDINATOR_SKIP_ROLES excludes roles whose creds are NOT provisioned:
# - aws-posture needs IAM Roles Anywhere / step-ca (not provisioned)
# - confluence-doc needs the confluence-bot Atlassian token (not provisioned)
# Remove a name here once its credential is provisioned to bring that checker online.
# confluence-doc is ONLINE (2026-06-22): authenticates via the OAuth 2.0
# client-credentials service account in ~/secrev.env (CONFLUENCE_BASE_URL +
# CONFLUENCE_OAUTH_CLIENT_ID/_SECRET); PAGE_MAP_FILE points at the IT page-ID map
# generated from the live space. Remove a name from the skip list once its
# credential is provisioned to bring that checker online.
[Unit]
Description=Sea Haven agent-team Plane-1 nightly checker coordinator
@ -33,7 +36,10 @@ WorkingDirectory=/home/adam/orchestrator/security-review
EnvironmentFile=-/home/adam/secrev.env
EnvironmentFile=-/home/adam/orchestrator/.env
Environment=GH_ORG=Sea-Haven-Industries
Environment=COORDINATOR_SKIP_ROLES=aws-posture,confluence-doc
Environment=COORDINATOR_SKIP_ROLES=aws-posture
# IT page-ID map for confluence-doc (generated from the live space; regenerate
# periodically as pages change).
Environment=PAGE_MAP_FILE=/home/adam/confluence-page-map.json
# Tune the shared ceiling without editing the script (uncomment to override):
# Environment=TOTAL_BUDGET_USD=120
# Environment=MAX_CYCLE_NIGHTS=4